The FBI’s case list shows we’re lucky not to have suffered more bombings. Don’t be surprised if we’re hit again.

Will Saletan writes about politics, science, technology, and other stuff for Slate. He’s the author of Bearing Right.

Every once in a while, a terrorist sets off a fatal bomb in the United States. In 1993, it was the World Trade Center. In 1995, it was Oklahoma City. In 1996, it was the Atlanta Olympics. Now it’s Boston. Each time it happens, we’re shocked.

But the attacks we see or hear about on TV are just the surface. The FBI is constantly tracking bomb plots. If you look at the bureau’s most recent cases—the ones in which it has announced investigations, arrests, indictments, convictions, or sentences since the beginning of 2012—you’ll discover that during this time frame, Boston is the 21st case involving explosives. And when you study these cases, you realize how lucky we’ve been. The next Boston may not be far behind.

2. Bomb size. Three of the 20 previous cases involved car bombs. All were inoperative, thanks to prior infiltration by law enforcement. One plotter thought he was detonating a 1,000-pound bomb. Another thought he was detonating an 1,800-pound bomb. Another tested his device at a quarry and said he wanted a bigger blast. The carnage in Boston could have been worse. Much worse.

5. Ingenuity. Among the 20 cases, the cleverest device—too clever, apparently—was the chemical underwear bomb in Detroit, with its syringe detonator. Another perpetrator wounded a man by hiding his device in a gift basket. A third researched ways to conceal explosives in a doll or a baby carriage.

6. Luck. In three of the 20 cases, the plotters had prior contacts with al-Qaida or other known terrorist groups outside the U.S. In five other cases, the plotters reached out to fellow jihadists or jihadist wannabes, either online or through other unspecified channels. This seems to be how we infiltrated and disarmed those plots, except for the underwear bomber. We’re plugged in to the jihadist network.

That leaves nine cases. In two of them, the defendants had explosives but no known targets. How did we discover the explosives? Dumb luck. One guy alarmed his neighbors by shooting at bottles from his back door. When the cops showed up, they found chemicals and devices they recognized, according to an indictment, as bomb components. Another woman shot at two utility workers who ventured onto her property to turn off her water for nonpayment. A search of her home turned up 122 improvised explosive devices.

Together, the 20 cases tell us several sobering things. First, the Boston Marathon is just the beginning of an expanded target list. Bombers have already aimed at restaurants, bars, and malls. We can expect more plots against gathering places where security is difficult, if not impossible, to guarantee.

Second, some of the components implicated in Boston—the backpack disguise, the household shrapnel—are common practice. They make it difficult for law enforcement agencies to detect plots and recognize explosive devices before the bombs go off.

Third, bombers are constantly innovating. They want better disguises and bigger blasts. If the devices used in Boston were Iraq-style pedestrian IEDs, the next device could be an Iraq-style car bomb.

Fourth, when you look at the 20 cases, you realize that Boston is just the tip of the iceberg. What’s surprising isn’t that the marathon bombing succeeded, but that so many other plots failed. In most of these cases, the culprits didn’t tap the jihadist networks we’ve infiltrated. Some of them did stupid things that caught our attention. Others, apparently unserious, tipped us off. Others botched their work.

It’s been more than a decade since this country endured a major bombing. We’ve been lucky. In Boston, our luck ran out. Don’t be surprised if it happens again.